car rental script vulnerabilities and fixes

Recent CVEs affecting car rental script, with upgrade or downgrade steps. 14 tracked.

Also searched as: carrentalscript.

car rental script has 14 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-12-07. Highest priority: CVE-2017-17637 (score 65/100).

• CVE-2023-48837 MEDIUM 5.4 DOWNGRADE Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.
• CVE-2023-48836 MEDIUM 5.4 DOWNGRADE Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_
• CVE-2023-48835 HIGH 8.8 DOWNGRADE Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
• CVE-2023-48834 HIGH 7.5 DOWNGRADE A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
• CVE-2023-40764 CRITICAL 9.8 DOWNGRADE User enumeration is found in PHP Jabbers Car Rental Script v3.0
• CVE-2023-40754 HIGH 8.8 DOWNGRADE In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on t
• CVE-2018-6904 MEDIUM 5.4 DOWNGRADE PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.
• CVE-2018-20648 HIGH 8.8 DOWNGRADE PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.
• CVE-2018-20647 MEDIUM 6.5 DOWNGRADE PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an imag
• CVE-2018-15182 MEDIUM 5.4 DOWNGRADE PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.
• CVE-2017-17907 MEDIUM 6.1 DOWNGRADE PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesetting
• CVE-2017-17906 CRITICAL 9.8 DOWNGRADE PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.
• CVE-2017-17905 HIGH 8.8 DOWNGRADE PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.
• CVE-2017-17637 CRITICAL 9.8 DOWNGRADE Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.

FAQ

How do I fix car rental script vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is car rental script being exploited right now?

None of the tracked car rental script CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which car rental script CVE should I patch first?

CVE-2017-17637 currently ranks highest (65/100): Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter..

RSS feed for car rental script · ← Back to latest CVEs